Important: firefox security update

2024-06-1700:00:00

Google

osv.dev

mozilla firefox

security update

version 115.12.0 esr

cve-2024-5702

networking

javascript object transplant

external protocol handlers

sandboxed iframes

cross-origin image leak

memory corruption

text fragments

memory safety bugs

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

24.1%

JSON

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 115.12.0 ESR.

Security Fix(es):

firefox: Use-after-free in networking (CVE-2024-5702)
firefox: Use-after-free in JavaScript object transplant (CVE-2024-5688)
firefox: External protocol handlers leaked by timing attack (CVE-2024-5690)
firefox: Sandboxed iframes were able to bypass sandbox restrictions to open a new window (CVE-2024-5691)
firefox: Cross-Origin Image leak via Offscreen Canvas (CVE-2024-5693)
firefox: Memory Corruption in Text Fragments (CVE-2024-5696)
firefox: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12 (CVE-2024-5700)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.